jaredandClaude Opus 4.8
43f4ceb45d
Phase C.1 of the protocol-gaps roadmap, gate-green (693 tests). Generalizes the Element Call widget host into a general room-widget feature: - StateEvent.Widget + widgetsPanelAtom + useRoomWidgets (WidgetParser). - RoomWidgetView: sandboxed-iframe host via ClientWidgetApi with a conservative GeneralWidgetDriver (approves only benign display caps — no room-event send/read/to-device). Blocks same-origin widget URLs (sandbox breakout guard). - WidgetsPanel: list / open / add / remove, PL-gated on im.vector.modular.widgets, https + non-same-origin URL validation. Mounted like the media gallery (header toggle + 3-way content-panel exclusivity + mobile full-screen overlay). - Tested URL/capability/id helpers. Requires the prod CSP frame-src widening (matrix repo) for external widgets. v1 cuts (capability consent prompt, Jitsi/sticker types, user widgets) noted. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
16 lines
831 B
TypeScript
16 lines
831 B
TypeScript
import { type Capability, WidgetDriver } from 'matrix-widget-api';
|
|
import { filterWidgetCapabilities } from './widgetUtils';
|
|
|
|
// A minimal, conservative WidgetDriver for general room widgets. It only narrows
|
|
// the capabilities a widget may hold (to a benign display-only subset — see
|
|
// widgetUtils). All data-access methods (sendEvent / readRoomState / sendToDevice
|
|
// / uploads …) are inherited from the base WidgetDriver and are never reached,
|
|
// because the capabilities that would gate them are denied here. A richer,
|
|
// consent-prompt-driven driver is a follow-up.
|
|
export class GeneralWidgetDriver extends WidgetDriver {
|
|
// eslint-disable-next-line class-methods-use-this
|
|
public async validateCapabilities(requested: Set<Capability>): Promise<Set<Capability>> {
|
|
return filterWidgetCapabilities(requested);
|
|
}
|
|
}
|